Feb 2021United StatesGoogle CSAM image classifier
In February 2021 a San Francisco father took photos of his toddler son's medical condition after a nurse asked for photos before a video consultation; the doctor used them to diagnose the problem and prescribe antibiotics. The New York Times reported in August 2022 that when the photos were backed up from his Android phone to Google's servers, Google's artificial-intelligence tool for recognising never-before-seen child abuse images flagged them. Two days after the photos were taken his Google account was disabled for 'harmful content', which cost him more than a decade of email, contacts and photos and, through Google Fi, his phone number. Google reported him to the National Center for Missing and Exploited Children, and the San Francisco police obtained search warrants for his account; the investigator concluded that no crime had occurred. Google refused to reinstate the account after two appeals, the second with the police report, and later notified him that it was being permanently deleted. The Times reported a second father in Houston whose photos of his toddler, taken at a paediatrician's request, were also flagged; his Gmail account was disabled in the middle of buying a house, Houston police questioned and cleared him, and he did not get the account back. Google said it stood by its decisions and that its reviewers had found a further video in the San Francisco father's account that it considered problematic.
Contextual tracker case Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 02/11/2026
2019BelgiumGoogle Assistant
On 10 July 2019 the Belgian public broadcaster VRT NWS reported that it had listened to more than a thousand audio excerpts recorded by Google Home smart speakers and the Google Assistant phone app, passed to it by someone working for a Google subcontractor that transcribes Dutch-language recordings to improve Google's speech recognition. VRT said 153 of the excerpts were conversations in which "Okay Google" was clearly not said, and that it could hear addresses and other sensitive information, which let it find and visit people in Flanders who recognised their own or relatives' voices. Google said one of its language reviewers had leaked confidential Dutch audio data, and explained that its devices rarely have "false accepts", when background noise or words are interpreted as the hotword. Google suspended human review of Assistant audio in Europe, and the Hamburg data protection authority began an urgency procedure under Article 66 of the GDPR to stop the reviews for three months, according to TechCrunch.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources · Added 28/10/2026
Dec 2019 to Jul 2020United StatesUnidentified facial recognition system
In a complaint filed in federal court in Pennsylvania on 19 December 2023, the US Federal Trade Commission alleged that the pharmacy chain Rite Aid used facial recognition in its stores to match customers against a database of people it suspected of shoplifting or other wrongdoing, and that staff acted on the match alerts by following, searching, ejecting and publicly accusing customers and by calling the police. The FTC says many alerts were false positives: employees recorded thousands of false-positive alerts between December 2019 and July 2020, staff stopped and searched an 11-year-old girl on a false match, and employees called the police on a Black woman matched to an image of a white woman with blonde hair. Rite Aid agreed to a proposed order barring it from using facial recognition in retail stores for five years, without admitting or denying the allegations.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 22/10/2026
Sept 2023AustraliaChatGPT
Victoria's Information Commissioner (OVIC) found in a report published on 24 September 2024 that a child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT in or around September 2023 to draft a Protection Application Report submitted to the Children's Court about a young child. On the balance of probabilities, OVIC found the worker entered personal information, including names, about the child, mother, father and carer, disclosing it to OpenAI; the worker admitted using ChatGPT but denied entering personal information. OVIC found generated content in the report described a doll that the father had reportedly used for sexual purposes as a parental strength ('age-appropriate toys'), downplaying the risk to the child, although the court's and the department's decisions did not change. The report was withdrawn and replaced, and the mother, father and carer described anxiety when told of the disclosure. OVIC found serious breaches of two privacy principles and issued a compliance notice requiring DFFH to ban and block generative AI text tools for child protection staff until November 2026; DFFH accepted the breach findings.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 22/10/2026
23 Sept 2024CanadaOtter.ai (reported)
An Ontario hospital reported to the provincial privacy commissioner that on 23 September 2024 the Otter.ai transcription tool, installed on a personal device by a physician who had left the hospital in June 2023 and was still on the meeting invite, joined a virtual hepatology rounds meeting, recorded it without notice and then emailed a summary and transcript access to the invite list. The personal health information of seven patients, including diagnoses and treatment, was captured; 12 of the 65 recipients appeared to have left the hospital. The commissioner's letter of 27 October 2025 recommended that the hospital itself ask Otter.ai to delete the retained patient data.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources, 1 underlying account · Added 21/10/2026
Sept 2026PakistanClaude (reported)
A teenager in Karachi was detained by Pakistan's National Cyber Crime Investigation Agency (NCCIA) and later released after his questions to an AI chatbot about how a character in a crime story could be killed were flagged, according to officials quoted by ARY News (29 September 2026) and the NCCIA as cited by ProPakistani (2 October 2026). ProPakistani reports that, according to the NCCIA, the platform's safety system flagged the queries on 4 September and the information was reportedly shared with the US FBI, which passed it to Pakistani authorities; ARY reports that the NCCIA carried out a raid and detained him. Bloom Pakistan, relaying The News, names the chatbot as Anthropic's Claude and reports that Anthropic reported the activity to the FBI. Officials said he told investigators he was writing a fictional crime story, and he was released after questioning; Bloom, relaying The News, says investigators found no grounds for prosecution but remained concerned.
Core + contextual relations Medium reported severity Involving minors Investigation Opened
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts · Added 14/10/2026
12 Mar 2025 to 15 Mar 2025AustraliaChatGPT
The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.
Contextual tracker case Low reported severity Investigation Opened
AI involvement supported · Causal attribution alleged · 4 sources, 1 underlying account · Added 29/09/2026
24 Jul 2026 to 26 Jul 2026IndiaUnidentified facial recognition system
In an affidavit of 17 August 2026 before the Supreme Court of India, Delhi Police said its Facial Recognition System (FRS) had identified 2,873 people with criminal antecedents at the Jantar Mantar protests of 20 to 26 July 2026 (2,402 through its 'Crime Kundli' biometric database and 471 through other criminal records). On 1 September the Court quashed the FIRs against the student protesters but let the police proceed against the 2,873; the police say any action will follow field verification. The Indian Express checked the 205 listed people facing murder, attempted-murder, rape or child-sexual-offence charges against police, prison and court records and found that at least 25 of them (17 accused of murder, four of rape (two or three under POCSO; the Express's narrative and its list differ), four of attempted murder) were lodged in Delhi's Tihar, Mandoli or Rohini prisons when the system logged them at the protest site with timestamps on 24, 25 and 26 July; some had been in custody for years. Delhi Police told the newspaper that further verification of the 2,873 was pending and, in its affidavit, that no action is taken solely on a facial-recognition result and that field verification follows each match. The police disclosed in 2022, in reply to a Right to Information request, that it treats a match with an 80 per cent similarity score as positive. Whether any of the 25 has since been named in the fresh FIR or visited for verification is not reported.
Contextual tracker case Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 24/09/2026
19 Jun 2026 to 13 Aug 2026BrazilChatGPT
A man in Brazil was held in pre-trial detention for 54 days in 2026 after OpenAI’s safety systems flagged his ChatGPT conversations and the company reported them to the FBI, which alerted Brazilian police. Police say the messages described a threat to a family member; he denies that intent and his lawyer says he only talked nonsense to the chatbot. A court released him on 13 August under precautionary measures; no charges had been filed as of mid-September. OpenAI did not give police ChatGPT’s replies.
Core + contextual relations High reported severity Investigation Opened
AI involvement supported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 23/09/2026
Aug 2024Event location unknownChatGPT
Arve Hjalmar Holmen asked ChatGPT "Who is Arve Hjalmar Holmen?" in August 2024, according to the BBC. The digital-rights group noyb's complaint on his behalf quotes the reply: it said he had been convicted of murdering two of his sons and of attempting to murder a third, and sentenced to 21 years in prison. The complaint says none of this happened and that he has never been accused or convicted of any crime, while the reply did contain real details such as his home town and the number and gender of his children. The complaint says he was deeply troubled by the output, and he said the thought that someone could read it and believe it scared him most. noyb filed the complaint with Norway's data protection authority, Datatilsynet, on 20 March 2025, asking it to order OpenAI to delete the output and correct its model and to impose a fine. OpenAI said the case related to an earlier version of ChatGPT since enhanced with online search. noyb also told the BBC he had made several searches that day and that they could have influenced the answer; the full conversation was not published. No decision on the complaint had been reported by 1 November 2026.
Core + contextual relations Medium reported severity Regulatory Action
AI involvement reported · Causal attribution alleged · 6 sources, 4 underlying accounts · Added 13/01/2026